git.squeep.com Git - akkoma/blob - test/web/twitter_api/twitter_api_controller_test.exs

   1 defmodule Pleroma.Web.TwitterAPI.ControllerTest do
   2   use Pleroma.Web.ConnCase
   3   alias Pleroma.Web.TwitterAPI.Representers.ActivityRepresenter
   4   alias Pleroma.Builders.{ActivityBuilder, UserBuilder}
   5   alias Pleroma.{Repo, Activity, User, Object, Notification}
   6   alias Pleroma.Web.ActivityPub.ActivityPub
   7   alias Pleroma.Web.TwitterAPI.UserView
   8   alias Pleroma.Web.TwitterAPI.NotificationView
   9   alias Pleroma.Web.CommonAPI
  10   alias Pleroma.Web.TwitterAPI.TwitterAPI
  11   alias Comeonin.Pbkdf2
  12   alias Ecto.Changeset
  13
  14   import Pleroma.Factory
  15
  16   @banner "data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7"
  17
  18   describe "POST /api/account/update_profile_banner" do
  19     test "it updates the banner", %{conn: conn} do
  20       user = insert(:user)
  21
  22       conn
  23       |> assign(:user, user)
  24       |> post(authenticated_twitter_api__path(conn, :update_banner), %{"banner" => @banner})
  25       |> json_response(200)
  26
  27       user = refresh_record(user)
  28       assert user.info.banner["type"] == "Image"
  29     end
  30   end
  31
  32   describe "POST /api/qvitter/update_background_image" do
  33     test "it updates the background", %{conn: conn} do
  34       user = insert(:user)
  35
  36       conn
  37       |> assign(:user, user)
  38       |> post(authenticated_twitter_api__path(conn, :update_background), %{"img" => @banner})
  39       |> json_response(200)
  40
  41       user = refresh_record(user)
  42       assert user.info.background["type"] == "Image"
  43     end
  44   end
  45
  46   describe "POST /api/account/verify_credentials" do
  47     setup [:valid_user]
  48
  49     test "without valid credentials", %{conn: conn} do
  50       conn = post(conn, "/api/account/verify_credentials.json")
  51       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
  52     end
  53
  54     test "with credentials", %{conn: conn, user: user} do
  55       response =
  56         conn
  57         |> with_credentials(user.nickname, "test")
  58         |> post("/api/account/verify_credentials.json")
  59         |> json_response(200)
  60
  61       assert response == UserView.render("show.json", %{user: user, token: response["token"]})
  62     end
  63   end
  64
  65   describe "POST /statuses/update.json" do
  66     setup [:valid_user]
  67
  68     test "without valid credentials", %{conn: conn} do
  69       conn = post(conn, "/api/statuses/update.json")
  70       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
  71     end
  72
  73     test "with credentials", %{conn: conn, user: user} do
  74       conn_with_creds = conn |> with_credentials(user.nickname, "test")
  75       request_path = "/api/statuses/update.json"
  76
  77       error_response = %{
  78         "request" => request_path,
  79         "error" => "Client must provide a 'status' parameter with a value."
  80       }
  81
  82       conn =
  83         conn_with_creds
  84         |> post(request_path)
  85
  86       assert json_response(conn, 400) == error_response
  87
  88       conn =
  89         conn_with_creds
  90         |> post(request_path, %{status: ""})
  91
  92       assert json_response(conn, 400) == error_response
  93
  94       conn =
  95         conn_with_creds
  96         |> post(request_path, %{status: " "})
  97
  98       assert json_response(conn, 400) == error_response
  99
 100       # we post with visibility private in order to avoid triggering relay
 101       conn =
 102         conn_with_creds
 103         |> post(request_path, %{status: "Nice meme.", visibility: "private"})
 104
 105       assert json_response(conn, 200) ==
 106                ActivityRepresenter.to_map(Repo.one(Activity), %{user: user})
 107     end
 108   end
 109
 110   describe "GET /statuses/public_timeline.json" do
 111     test "returns statuses", %{conn: conn} do
 112       user = insert(:user)
 113       activities = ActivityBuilder.insert_list(30, %{}, %{user: user})
 114       ActivityBuilder.insert_list(10, %{}, %{user: user})
 115       since_id = List.last(activities).id
 116
 117       conn =
 118         conn
 119         |> get("/api/statuses/public_timeline.json", %{since_id: since_id})
 120
 121       response = json_response(conn, 200)
 122
 123       assert length(response) == 10
 124     end
 125
 126     test "returns 403 to unauthenticated request when the instance is not public", %{conn: conn} do
 127       instance =
 128         Application.get_env(:pleroma, :instance)
 129         |> Keyword.put(:public, false)
 130
 131       Application.put_env(:pleroma, :instance, instance)
 132
 133       conn
 134       |> get("/api/statuses/public_timeline.json")
 135       |> json_response(403)
 136
 137       instance =
 138         Application.get_env(:pleroma, :instance)
 139         |> Keyword.put(:public, true)
 140
 141       Application.put_env(:pleroma, :instance, instance)
 142     end
 143
 144     test "returns 200 to unauthenticated request when the instance is public", %{conn: conn} do
 145       conn
 146       |> get("/api/statuses/public_timeline.json")
 147       |> json_response(200)
 148     end
 149   end
 150
 151   describe "GET /statuses/public_and_external_timeline.json" do
 152     test "returns 403 to unauthenticated request when the instance is not public", %{conn: conn} do
 153       instance =
 154         Application.get_env(:pleroma, :instance)
 155         |> Keyword.put(:public, false)
 156
 157       Application.put_env(:pleroma, :instance, instance)
 158
 159       conn
 160       |> get("/api/statuses/public_and_external_timeline.json")
 161       |> json_response(403)
 162
 163       instance =
 164         Application.get_env(:pleroma, :instance)
 165         |> Keyword.put(:public, true)
 166
 167       Application.put_env(:pleroma, :instance, instance)
 168     end
 169
 170     test "returns 200 to unauthenticated request when the instance is public", %{conn: conn} do
 171       conn
 172       |> get("/api/statuses/public_and_external_timeline.json")
 173       |> json_response(200)
 174     end
 175   end
 176
 177   describe "GET /statuses/show/:id.json" do
 178     test "returns one status", %{conn: conn} do
 179       user = insert(:user)
 180       {:ok, activity} = CommonAPI.post(user, %{"status" => "Hey!"})
 181       actor = Repo.get_by!(User, ap_id: activity.data["actor"])
 182
 183       conn =
 184         conn
 185         |> get("/api/statuses/show/#{activity.id}.json")
 186
 187       response = json_response(conn, 200)
 188
 189       assert response == ActivityRepresenter.to_map(activity, %{user: actor})
 190     end
 191   end
 192
 193   describe "GET /users/show.json" do
 194     test "gets user with screen_name", %{conn: conn} do
 195       user = insert(:user)
 196
 197       conn =
 198         conn
 199         |> get("/api/users/show.json", %{"screen_name" => user.nickname})
 200
 201       response = json_response(conn, 200)
 202
 203       assert response["id"] == user.id
 204     end
 205
 206     test "gets user with user_id", %{conn: conn} do
 207       user = insert(:user)
 208
 209       conn =
 210         conn
 211         |> get("/api/users/show.json", %{"user_id" => user.id})
 212
 213       response = json_response(conn, 200)
 214
 215       assert response["id"] == user.id
 216     end
 217
 218     test "gets a user for a logged in user", %{conn: conn} do
 219       user = insert(:user)
 220       logged_in = insert(:user)
 221
 222       {:ok, logged_in, user, _activity} = TwitterAPI.follow(logged_in, %{"user_id" => user.id})
 223
 224       conn =
 225         conn
 226         |> with_credentials(logged_in.nickname, "test")
 227         |> get("/api/users/show.json", %{"user_id" => user.id})
 228
 229       response = json_response(conn, 200)
 230
 231       assert response["following"] == true
 232     end
 233   end
 234
 235   describe "GET /statusnet/conversation/:id.json" do
 236     test "returns the statuses in the conversation", %{conn: conn} do
 237       {:ok, _user} = UserBuilder.insert()
 238       {:ok, activity} = ActivityBuilder.insert(%{"type" => "Create", "context" => "2hu"})
 239       {:ok, _activity_two} = ActivityBuilder.insert(%{"type" => "Create", "context" => "2hu"})
 240       {:ok, _activity_three} = ActivityBuilder.insert(%{"type" => "Create", "context" => "3hu"})
 241
 242       conn =
 243         conn
 244         |> get("/api/statusnet/conversation/#{activity.data["context_id"]}.json")
 245
 246       response = json_response(conn, 200)
 247
 248       assert length(response) == 2
 249     end
 250   end
 251
 252   describe "GET /statuses/friends_timeline.json" do
 253     setup [:valid_user]
 254
 255     test "without valid credentials", %{conn: conn} do
 256       conn = get(conn, "/api/statuses/friends_timeline.json")
 257       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 258     end
 259
 260     test "with credentials", %{conn: conn, user: current_user} do
 261       user = insert(:user)
 262
 263       activities =
 264         ActivityBuilder.insert_list(30, %{"to" => [User.ap_followers(user)]}, %{user: user})
 265
 266       returned_activities =
 267         ActivityBuilder.insert_list(10, %{"to" => [User.ap_followers(user)]}, %{user: user})
 268
 269       other_user = insert(:user)
 270       ActivityBuilder.insert_list(10, %{}, %{user: other_user})
 271       since_id = List.last(activities).id
 272
 273       current_user =
 274         Changeset.change(current_user, following: [User.ap_followers(user)])
 275         |> Repo.update!()
 276
 277       conn =
 278         conn
 279         |> with_credentials(current_user.nickname, "test")
 280         |> get("/api/statuses/friends_timeline.json", %{since_id: since_id})
 281
 282       response = json_response(conn, 200)
 283
 284       assert length(response) == 10
 285
 286       assert response ==
 287                Enum.map(returned_activities, fn activity ->
 288                  ActivityRepresenter.to_map(activity, %{
 289                    user: User.get_cached_by_ap_id(activity.data["actor"]),
 290                    for: current_user
 291                  })
 292                end)
 293     end
 294   end
 295
 296   describe "GET /statuses/dm_timeline.json" do
 297     test "it show direct messages", %{conn: conn} do
 298       user_one = insert(:user)
 299       user_two = insert(:user)
 300
 301       {:ok, user_two} = User.follow(user_two, user_one)
 302
 303       {:ok, direct} =
 304         CommonAPI.post(user_one, %{
 305           "status" => "Hi @#{user_two.nickname}!",
 306           "visibility" => "direct"
 307         })
 308
 309       {:ok, direct_two} =
 310         CommonAPI.post(user_two, %{
 311           "status" => "Hi @#{user_one.nickname}!",
 312           "visibility" => "direct"
 313         })
 314
 315       {:ok, _follower_only} =
 316         CommonAPI.post(user_one, %{
 317           "status" => "Hi @#{user_two.nickname}!",
 318           "visibility" => "private"
 319         })
 320
 321       # Only direct should be visible here
 322       res_conn =
 323         conn
 324         |> assign(:user, user_two)
 325         |> get("/api/statuses/dm_timeline.json")
 326
 327       [status, status_two] = json_response(res_conn, 200)
 328       assert status["id"] == direct_two.id
 329       assert status_two["id"] == direct.id
 330     end
 331   end
 332
 333   describe "GET /statuses/mentions.json" do
 334     setup [:valid_user]
 335
 336     test "without valid credentials", %{conn: conn} do
 337       conn = get(conn, "/api/statuses/mentions.json")
 338       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 339     end
 340
 341     test "with credentials", %{conn: conn, user: current_user} do
 342       {:ok, activity} =
 343         ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: current_user})
 344
 345       conn =
 346         conn
 347         |> with_credentials(current_user.nickname, "test")
 348         |> get("/api/statuses/mentions.json")
 349
 350       response = json_response(conn, 200)
 351
 352       assert length(response) == 1
 353
 354       assert Enum.at(response, 0) ==
 355                ActivityRepresenter.to_map(activity, %{
 356                  user: current_user,
 357                  mentioned: [current_user]
 358                })
 359     end
 360   end
 361
 362   describe "GET /api/qvitter/statuses/notifications.json" do
 363     setup [:valid_user]
 364
 365     test "without valid credentials", %{conn: conn} do
 366       conn = get(conn, "/api/qvitter/statuses/notifications.json")
 367       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 368     end
 369
 370     test "with credentials", %{conn: conn, user: current_user} do
 371       other_user = insert(:user)
 372
 373       {:ok, _activity} =
 374         ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: other_user})
 375
 376       conn =
 377         conn
 378         |> with_credentials(current_user.nickname, "test")
 379         |> get("/api/qvitter/statuses/notifications.json")
 380
 381       response = json_response(conn, 200)
 382
 383       assert length(response) == 1
 384
 385       assert response ==
 386                NotificationView.render("notification.json", %{
 387                  notifications: Notification.for_user(current_user),
 388                  for: current_user
 389                })
 390     end
 391   end
 392
 393   describe "POST /api/qvitter/statuses/notifications/read" do
 394     setup [:valid_user]
 395
 396     test "without valid credentials", %{conn: conn} do
 397       conn = post(conn, "/api/qvitter/statuses/notifications/read", %{"latest_id" => 1_234_567})
 398       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 399     end
 400
 401     test "with credentials, without any params", %{conn: conn, user: current_user} do
 402       conn =
 403         conn
 404         |> with_credentials(current_user.nickname, "test")
 405         |> post("/api/qvitter/statuses/notifications/read")
 406
 407       assert json_response(conn, 400) == %{
 408                "error" => "You need to specify latest_id",
 409                "request" => "/api/qvitter/statuses/notifications/read"
 410              }
 411     end
 412
 413     test "with credentials, with params", %{conn: conn, user: current_user} do
 414       other_user = insert(:user)
 415
 416       {:ok, _activity} =
 417         ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: other_user})
 418
 419       response_conn =
 420         conn
 421         |> with_credentials(current_user.nickname, "test")
 422         |> get("/api/qvitter/statuses/notifications.json")
 423
 424       [notification] = response = json_response(response_conn, 200)
 425
 426       assert length(response) == 1
 427
 428       assert notification["is_seen"] == 0
 429
 430       response_conn =
 431         conn
 432         |> with_credentials(current_user.nickname, "test")
 433         |> post("/api/qvitter/statuses/notifications/read", %{"latest_id" => notification["id"]})
 434
 435       [notification] = response = json_response(response_conn, 200)
 436
 437       assert length(response) == 1
 438
 439       assert notification["is_seen"] == 1
 440     end
 441   end
 442
 443   describe "GET /statuses/user_timeline.json" do
 444     setup [:valid_user]
 445
 446     test "without any params", %{conn: conn} do
 447       conn = get(conn, "/api/statuses/user_timeline.json")
 448
 449       assert json_response(conn, 400) == %{
 450                "error" => "You need to specify screen_name or user_id",
 451                "request" => "/api/statuses/user_timeline.json"
 452              }
 453     end
 454
 455     test "with user_id", %{conn: conn} do
 456       user = insert(:user)
 457       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 458
 459       conn = get(conn, "/api/statuses/user_timeline.json", %{"user_id" => user.id})
 460       response = json_response(conn, 200)
 461       assert length(response) == 1
 462       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 463     end
 464
 465     test "with screen_name", %{conn: conn} do
 466       user = insert(:user)
 467       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 468
 469       conn = get(conn, "/api/statuses/user_timeline.json", %{"screen_name" => user.nickname})
 470       response = json_response(conn, 200)
 471       assert length(response) == 1
 472       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 473     end
 474
 475     test "with credentials", %{conn: conn, user: current_user} do
 476       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: current_user})
 477
 478       conn =
 479         conn
 480         |> with_credentials(current_user.nickname, "test")
 481         |> get("/api/statuses/user_timeline.json")
 482
 483       response = json_response(conn, 200)
 484
 485       assert length(response) == 1
 486       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: current_user})
 487     end
 488
 489     test "with credentials with user_id", %{conn: conn, user: current_user} do
 490       user = insert(:user)
 491       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 492
 493       conn =
 494         conn
 495         |> with_credentials(current_user.nickname, "test")
 496         |> get("/api/statuses/user_timeline.json", %{"user_id" => user.id})
 497
 498       response = json_response(conn, 200)
 499
 500       assert length(response) == 1
 501       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 502     end
 503
 504     test "with credentials screen_name", %{conn: conn, user: current_user} do
 505       user = insert(:user)
 506       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 507
 508       conn =
 509         conn
 510         |> with_credentials(current_user.nickname, "test")
 511         |> get("/api/statuses/user_timeline.json", %{"screen_name" => user.nickname})
 512
 513       response = json_response(conn, 200)
 514
 515       assert length(response) == 1
 516       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 517     end
 518   end
 519
 520   describe "POST /friendships/create.json" do
 521     setup [:valid_user]
 522
 523     test "without valid credentials", %{conn: conn} do
 524       conn = post(conn, "/api/friendships/create.json")
 525       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 526     end
 527
 528     test "with credentials", %{conn: conn, user: current_user} do
 529       followed = insert(:user)
 530
 531       conn =
 532         conn
 533         |> with_credentials(current_user.nickname, "test")
 534         |> post("/api/friendships/create.json", %{user_id: followed.id})
 535
 536       current_user = Repo.get(User, current_user.id)
 537       assert User.ap_followers(followed) in current_user.following
 538
 539       assert json_response(conn, 200) ==
 540                UserView.render("show.json", %{user: followed, for: current_user})
 541     end
 542   end
 543
 544   describe "POST /friendships/destroy.json" do
 545     setup [:valid_user]
 546
 547     test "without valid credentials", %{conn: conn} do
 548       conn = post(conn, "/api/friendships/destroy.json")
 549       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 550     end
 551
 552     test "with credentials", %{conn: conn, user: current_user} do
 553       followed = insert(:user)
 554
 555       {:ok, current_user} = User.follow(current_user, followed)
 556       assert User.ap_followers(followed) in current_user.following
 557       ActivityPub.follow(current_user, followed)
 558
 559       conn =
 560         conn
 561         |> with_credentials(current_user.nickname, "test")
 562         |> post("/api/friendships/destroy.json", %{user_id: followed.id})
 563
 564       current_user = Repo.get(User, current_user.id)
 565       assert current_user.following == [current_user.ap_id]
 566
 567       assert json_response(conn, 200) ==
 568                UserView.render("show.json", %{user: followed, for: current_user})
 569     end
 570   end
 571
 572   describe "POST /blocks/create.json" do
 573     setup [:valid_user]
 574
 575     test "without valid credentials", %{conn: conn} do
 576       conn = post(conn, "/api/blocks/create.json")
 577       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 578     end
 579
 580     test "with credentials", %{conn: conn, user: current_user} do
 581       blocked = insert(:user)
 582
 583       conn =
 584         conn
 585         |> with_credentials(current_user.nickname, "test")
 586         |> post("/api/blocks/create.json", %{user_id: blocked.id})
 587
 588       current_user = Repo.get(User, current_user.id)
 589       assert User.blocks?(current_user, blocked)
 590
 591       assert json_response(conn, 200) ==
 592                UserView.render("show.json", %{user: blocked, for: current_user})
 593     end
 594   end
 595
 596   describe "POST /blocks/destroy.json" do
 597     setup [:valid_user]
 598
 599     test "without valid credentials", %{conn: conn} do
 600       conn = post(conn, "/api/blocks/destroy.json")
 601       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 602     end
 603
 604     test "with credentials", %{conn: conn, user: current_user} do
 605       blocked = insert(:user)
 606
 607       {:ok, current_user, blocked} = TwitterAPI.block(current_user, %{"user_id" => blocked.id})
 608       assert User.blocks?(current_user, blocked)
 609
 610       conn =
 611         conn
 612         |> with_credentials(current_user.nickname, "test")
 613         |> post("/api/blocks/destroy.json", %{user_id: blocked.id})
 614
 615       current_user = Repo.get(User, current_user.id)
 616       assert current_user.info.blocks == []
 617
 618       assert json_response(conn, 200) ==
 619                UserView.render("show.json", %{user: blocked, for: current_user})
 620     end
 621   end
 622
 623   describe "GET /help/test.json" do
 624     test "returns \"ok\"", %{conn: conn} do
 625       conn = get(conn, "/api/help/test.json")
 626       assert json_response(conn, 200) == "ok"
 627     end
 628   end
 629
 630   describe "POST /api/qvitter/update_avatar.json" do
 631     setup [:valid_user]
 632
 633     test "without valid credentials", %{conn: conn} do
 634       conn = post(conn, "/api/qvitter/update_avatar.json")
 635       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 636     end
 637
 638     test "with credentials", %{conn: conn, user: current_user} do
 639       avatar_image = File.read!("test/fixtures/avatar_data_uri")
 640
 641       conn =
 642         conn
 643         |> with_credentials(current_user.nickname, "test")
 644         |> post("/api/qvitter/update_avatar.json", %{img: avatar_image})
 645
 646       current_user = Repo.get(User, current_user.id)
 647       assert is_map(current_user.avatar)
 648
 649       assert json_response(conn, 200) ==
 650                UserView.render("show.json", %{user: current_user, for: current_user})
 651     end
 652   end
 653
 654   describe "GET /api/qvitter/mutes.json" do
 655     setup [:valid_user]
 656
 657     test "unimplemented mutes without valid credentials", %{conn: conn} do
 658       conn = get(conn, "/api/qvitter/mutes.json")
 659       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 660     end
 661
 662     test "unimplemented mutes with credentials", %{conn: conn, user: current_user} do
 663       response =
 664         conn
 665         |> with_credentials(current_user.nickname, "test")
 666         |> get("/api/qvitter/mutes.json")
 667         |> json_response(200)
 668
 669       assert [] = response
 670     end
 671   end
 672
 673   describe "POST /api/favorites/create/:id" do
 674     setup [:valid_user]
 675
 676     test "without valid credentials", %{conn: conn} do
 677       note_activity = insert(:note_activity)
 678       conn = post(conn, "/api/favorites/create/#{note_activity.id}.json")
 679       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 680     end
 681
 682     test "with credentials", %{conn: conn, user: current_user} do
 683       note_activity = insert(:note_activity)
 684
 685       conn =
 686         conn
 687         |> with_credentials(current_user.nickname, "test")
 688         |> post("/api/favorites/create/#{note_activity.id}.json")
 689
 690       assert json_response(conn, 200)
 691     end
 692
 693     test "with credentials, invalid param", %{conn: conn, user: current_user} do
 694       conn =
 695         conn
 696         |> with_credentials(current_user.nickname, "test")
 697         |> post("/api/favorites/create/wrong.json")
 698
 699       assert json_response(conn, 400)
 700     end
 701
 702     test "with credentials, invalid activity", %{conn: conn, user: current_user} do
 703       conn =
 704         conn
 705         |> with_credentials(current_user.nickname, "test")
 706         |> post("/api/favorites/create/1.json")
 707
 708       assert json_response(conn, 500)
 709     end
 710   end
 711
 712   describe "POST /api/favorites/destroy/:id" do
 713     setup [:valid_user]
 714
 715     test "without valid credentials", %{conn: conn} do
 716       note_activity = insert(:note_activity)
 717       conn = post(conn, "/api/favorites/destroy/#{note_activity.id}.json")
 718       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 719     end
 720
 721     test "with credentials", %{conn: conn, user: current_user} do
 722       note_activity = insert(:note_activity)
 723       object = Object.get_by_ap_id(note_activity.data["object"]["id"])
 724       ActivityPub.like(current_user, object)
 725
 726       conn =
 727         conn
 728         |> with_credentials(current_user.nickname, "test")
 729         |> post("/api/favorites/destroy/#{note_activity.id}.json")
 730
 731       assert json_response(conn, 200)
 732     end
 733   end
 734
 735   describe "POST /api/statuses/retweet/:id" do
 736     setup [:valid_user]
 737
 738     test "without valid credentials", %{conn: conn} do
 739       note_activity = insert(:note_activity)
 740       conn = post(conn, "/api/statuses/retweet/#{note_activity.id}.json")
 741       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 742     end
 743
 744     test "with credentials", %{conn: conn, user: current_user} do
 745       note_activity = insert(:note_activity)
 746
 747       request_path = "/api/statuses/retweet/#{note_activity.id}.json"
 748
 749       response =
 750         conn
 751         |> with_credentials(current_user.nickname, "test")
 752         |> post(request_path)
 753
 754       activity = Repo.get(Activity, note_activity.id)
 755       activity_user = Repo.get_by(User, ap_id: note_activity.data["actor"])
 756
 757       assert json_response(response, 200) ==
 758                ActivityRepresenter.to_map(activity, %{user: activity_user, for: current_user})
 759     end
 760   end
 761
 762   describe "POST /api/statuses/unretweet/:id" do
 763     setup [:valid_user]
 764
 765     test "without valid credentials", %{conn: conn} do
 766       note_activity = insert(:note_activity)
 767       conn = post(conn, "/api/statuses/unretweet/#{note_activity.id}.json")
 768       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 769     end
 770
 771     test "with credentials", %{conn: conn, user: current_user} do
 772       note_activity = insert(:note_activity)
 773
 774       request_path = "/api/statuses/retweet/#{note_activity.id}.json"
 775
 776       _response =
 777         conn
 778         |> with_credentials(current_user.nickname, "test")
 779         |> post(request_path)
 780
 781       request_path = String.replace(request_path, "retweet", "unretweet")
 782
 783       response =
 784         conn
 785         |> with_credentials(current_user.nickname, "test")
 786         |> post(request_path)
 787
 788       activity = Repo.get(Activity, note_activity.id)
 789       activity_user = Repo.get_by(User, ap_id: note_activity.data["actor"])
 790
 791       assert json_response(response, 200) ==
 792                ActivityRepresenter.to_map(activity, %{user: activity_user, for: current_user})
 793     end
 794   end
 795
 796   describe "POST /api/account/register" do
 797     test "it creates a new user", %{conn: conn} do
 798       data = %{
 799         "nickname" => "lain",
 800         "email" => "lain@wired.jp",
 801         "fullname" => "lain iwakura",
 802         "bio" => "close the world.",
 803         "password" => "bear",
 804         "confirm" => "bear"
 805       }
 806
 807       conn =
 808         conn
 809         |> post("/api/account/register", data)
 810
 811       user = json_response(conn, 200)
 812
 813       fetched_user = Repo.get_by(User, nickname: "lain")
 814       assert user == UserView.render("show.json", %{user: fetched_user})
 815     end
 816
 817     test "it returns errors on a problem", %{conn: conn} do
 818       data = %{
 819         "email" => "lain@wired.jp",
 820         "fullname" => "lain iwakura",
 821         "bio" => "close the world.",
 822         "password" => "bear",
 823         "confirm" => "bear"
 824       }
 825
 826       conn =
 827         conn
 828         |> post("/api/account/register", data)
 829
 830       errors = json_response(conn, 400)
 831
 832       assert is_binary(errors["error"])
 833     end
 834   end
 835
 836   describe "POST /api/account/password_reset, with valid parameters" do
 837     setup %{conn: conn} do
 838       user = insert(:user)
 839       conn = post(conn, "/api/account/password_reset?email=#{user.email}")
 840       %{conn: conn, user: user}
 841     end
 842
 843     test "it returns 204", %{conn: conn} do
 844       assert json_response(conn, :no_content)
 845     end
 846
 847     test "it creates a PasswordResetToken record for user", %{user: user} do
 848       token_record = Repo.get_by(Pleroma.PasswordResetToken, user_id: user.id)
 849       assert token_record
 850     end
 851
 852     test "it sends an email to user", %{user: user} do
 853       token_record = Repo.get_by(Pleroma.PasswordResetToken, user_id: user.id)
 854
 855       Swoosh.TestAssertions.assert_email_sent(
 856         Pleroma.UserEmail.password_reset_email(user, token_record.token)
 857       )
 858     end
 859   end
 860
 861   describe "POST /api/account/password_reset, with invalid parameters" do
 862     setup [:valid_user]
 863
 864     test "it returns 500 when user is not found", %{conn: conn, user: user} do
 865       conn = post(conn, "/api/account/password_reset?email=nonexisting_#{user.email}")
 866       assert json_response(conn, :internal_server_error)
 867     end
 868
 869     test "it returns 500 when user is not local", %{conn: conn, user: user} do
 870       {:ok, user} = Repo.update(Changeset.change(user, local: false))
 871       conn = post(conn, "/api/account/password_reset?email=#{user.email}")
 872       assert json_response(conn, :internal_server_error)
 873     end
 874   end
 875
 876   describe "POST /api/email_invite, with valid parameters" do
 877     setup [:valid_user]
 878
 879     setup do
 880       invites_enabled = Pleroma.Config.get([:instance, :invites_enabled])
 881       Pleroma.Config.put([:instance, :invites_enabled], true)
 882
 883       on_exit(fn ->
 884         Pleroma.Config.put([:instance, :invites_enabled], invites_enabled)
 885         :ok
 886       end)
 887
 888       :ok
 889     end
 890
 891     test "it returns 204", %{conn: conn, user: user} do
 892       recipient_email = "foo@bar.com"
 893       recipient_name = "J. D."
 894
 895       conn =
 896         conn
 897         |> assign(:user, user)
 898         |> post("/api/email_invite?email=#{recipient_email}&name=#{recipient_name}")
 899
 900       assert json_response(conn, :no_content)
 901
 902       Swoosh.TestAssertions.assert_email_sent(
 903         Pleroma.UserEmail.user_invitation_email(user, recipient_email, recipient_name)
 904       )
 905     end
 906   end
 907
 908   describe "GET /api/externalprofile/show" do
 909     test "it returns the user", %{conn: conn} do
 910       user = insert(:user)
 911       other_user = insert(:user)
 912
 913       conn =
 914         conn
 915         |> assign(:user, user)
 916         |> get("/api/externalprofile/show", %{profileurl: other_user.ap_id})
 917
 918       assert json_response(conn, 200) == UserView.render("show.json", %{user: other_user})
 919     end
 920   end
 921
 922   describe "GET /api/statuses/followers" do
 923     test "it returns a user's followers", %{conn: conn} do
 924       user = insert(:user)
 925       follower_one = insert(:user)
 926       follower_two = insert(:user)
 927       _not_follower = insert(:user)
 928
 929       {:ok, follower_one} = User.follow(follower_one, user)
 930       {:ok, follower_two} = User.follow(follower_two, user)
 931
 932       conn =
 933         conn
 934         |> assign(:user, user)
 935         |> get("/api/statuses/followers")
 936
 937       expected = UserView.render("index.json", %{users: [follower_one, follower_two], for: user})
 938       result = json_response(conn, 200)
 939       assert Enum.sort(expected) == Enum.sort(result)
 940     end
 941
 942     test "it returns a given user's followers with user_id", %{conn: conn} do
 943       user = insert(:user)
 944       follower_one = insert(:user)
 945       follower_two = insert(:user)
 946       not_follower = insert(:user)
 947
 948       {:ok, follower_one} = User.follow(follower_one, user)
 949       {:ok, follower_two} = User.follow(follower_two, user)
 950
 951       conn =
 952         conn
 953         |> assign(:user, not_follower)
 954         |> get("/api/statuses/followers", %{"user_id" => user.id})
 955
 956       assert MapSet.equal?(
 957                MapSet.new(json_response(conn, 200)),
 958                MapSet.new(
 959                  UserView.render("index.json", %{
 960                    users: [follower_one, follower_two],
 961                    for: not_follower
 962                  })
 963                )
 964              )
 965     end
 966
 967     test "it returns empty for a hidden network", %{conn: conn} do
 968       user = insert(:user, %{info: %{hide_network: true}})
 969       follower_one = insert(:user)
 970       follower_two = insert(:user)
 971       not_follower = insert(:user)
 972
 973       {:ok, _follower_one} = User.follow(follower_one, user)
 974       {:ok, _follower_two} = User.follow(follower_two, user)
 975
 976       response =
 977         conn
 978         |> assign(:user, not_follower)
 979         |> get("/api/statuses/followers", %{"user_id" => user.id})
 980         |> json_response(200)
 981
 982       assert [] == response
 983     end
 984
 985     test "it returns the followers for a hidden network if requested by the user themselves", %{
 986       conn: conn
 987     } do
 988       user = insert(:user, %{info: %{hide_network: true}})
 989       follower_one = insert(:user)
 990       follower_two = insert(:user)
 991       _not_follower = insert(:user)
 992
 993       {:ok, _follower_one} = User.follow(follower_one, user)
 994       {:ok, _follower_two} = User.follow(follower_two, user)
 995
 996       conn =
 997         conn
 998         |> assign(:user, user)
 999         |> get("/api/statuses/followers", %{"user_id" => user.id})
1000
1001       refute [] == json_response(conn, 200)
1002     end
1003   end
1004
1005   describe "GET /api/statuses/friends" do
1006     test "it returns the logged in user's friends", %{conn: conn} do
1007       user = insert(:user)
1008       followed_one = insert(:user)
1009       followed_two = insert(:user)
1010       _not_followed = insert(:user)
1011
1012       {:ok, user} = User.follow(user, followed_one)
1013       {:ok, user} = User.follow(user, followed_two)
1014
1015       conn =
1016         conn
1017         |> assign(:user, user)
1018         |> get("/api/statuses/friends")
1019
1020       expected = UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
1021       result = json_response(conn, 200)
1022       assert Enum.sort(expected) == Enum.sort(result)
1023     end
1024
1025     test "it returns a given user's friends with user_id", %{conn: conn} do
1026       user = insert(:user)
1027       followed_one = insert(:user)
1028       followed_two = insert(:user)
1029       _not_followed = insert(:user)
1030
1031       {:ok, user} = User.follow(user, followed_one)
1032       {:ok, user} = User.follow(user, followed_two)
1033
1034       conn =
1035         conn
1036         |> assign(:user, user)
1037         |> get("/api/statuses/friends", %{"user_id" => user.id})
1038
1039       assert MapSet.equal?(
1040                MapSet.new(json_response(conn, 200)),
1041                MapSet.new(
1042                  UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
1043                )
1044              )
1045     end
1046
1047     test "it returns empty for a hidden network", %{conn: conn} do
1048       user = insert(:user, %{info: %{hide_network: true}})
1049       followed_one = insert(:user)
1050       followed_two = insert(:user)
1051       not_followed = insert(:user)
1052
1053       {:ok, user} = User.follow(user, followed_one)
1054       {:ok, user} = User.follow(user, followed_two)
1055
1056       conn =
1057         conn
1058         |> assign(:user, not_followed)
1059         |> get("/api/statuses/friends", %{"user_id" => user.id})
1060
1061       assert [] == json_response(conn, 200)
1062     end
1063
1064     test "it returns friends for a hidden network if the user themselves request it", %{
1065       conn: conn
1066     } do
1067       user = insert(:user, %{info: %{hide_network: true}})
1068       followed_one = insert(:user)
1069       followed_two = insert(:user)
1070       _not_followed = insert(:user)
1071
1072       {:ok, _user} = User.follow(user, followed_one)
1073       {:ok, _user} = User.follow(user, followed_two)
1074
1075       response =
1076         conn
1077         |> assign(:user, user)
1078         |> get("/api/statuses/friends", %{"user_id" => user.id})
1079         |> json_response(200)
1080
1081       refute [] == response
1082     end
1083
1084     test "it returns a given user's friends with screen_name", %{conn: conn} do
1085       user = insert(:user)
1086       followed_one = insert(:user)
1087       followed_two = insert(:user)
1088       _not_followed = insert(:user)
1089
1090       {:ok, user} = User.follow(user, followed_one)
1091       {:ok, user} = User.follow(user, followed_two)
1092
1093       conn =
1094         conn
1095         |> assign(:user, user)
1096         |> get("/api/statuses/friends", %{"screen_name" => user.nickname})
1097
1098       assert MapSet.equal?(
1099                MapSet.new(json_response(conn, 200)),
1100                MapSet.new(
1101                  UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
1102                )
1103              )
1104     end
1105   end
1106
1107   describe "GET /friends/ids" do
1108     test "it returns a user's friends", %{conn: conn} do
1109       user = insert(:user)
1110       followed_one = insert(:user)
1111       followed_two = insert(:user)
1112       _not_followed = insert(:user)
1113
1114       {:ok, user} = User.follow(user, followed_one)
1115       {:ok, user} = User.follow(user, followed_two)
1116
1117       conn =
1118         conn
1119         |> assign(:user, user)
1120         |> get("/api/friends/ids")
1121
1122       expected = [followed_one.id, followed_two.id]
1123
1124       assert MapSet.equal?(
1125                MapSet.new(Poison.decode!(json_response(conn, 200))),
1126                MapSet.new(expected)
1127              )
1128     end
1129   end
1130
1131   describe "POST /api/account/update_profile.json" do
1132     test "it updates a user's profile", %{conn: conn} do
1133       user = insert(:user)
1134       user2 = insert(:user)
1135
1136       conn =
1137         conn
1138         |> assign(:user, user)
1139         |> post("/api/account/update_profile.json", %{
1140           "name" => "new name",
1141           "description" => "hi @#{user2.nickname}"
1142         })
1143
1144       user = Repo.get!(User, user.id)
1145       assert user.name == "new name"
1146
1147       assert user.bio ==
1148                "hi <span><a data-user='#{user2.id}' class='mention' href='#{user2.ap_id}'>@<span>#{
1149                  user2.nickname
1150                }</span></a></span>"
1151
1152       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1153     end
1154
1155     test "it sets and un-sets hide_network", %{conn: conn} do
1156       user = insert(:user)
1157
1158       conn
1159       |> assign(:user, user)
1160       |> post("/api/account/update_profile.json", %{
1161         "hide_network" => "true"
1162       })
1163
1164       user = Repo.get!(User, user.id)
1165       assert user.info.hide_network == true
1166
1167       conn =
1168         conn
1169         |> assign(:user, user)
1170         |> post("/api/account/update_profile.json", %{
1171           "hide_network" => "false"
1172         })
1173
1174       user = Repo.get!(User, user.id)
1175       assert user.info.hide_network == false
1176       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1177     end
1178
1179     test "it locks an account", %{conn: conn} do
1180       user = insert(:user)
1181
1182       conn =
1183         conn
1184         |> assign(:user, user)
1185         |> post("/api/account/update_profile.json", %{
1186           "locked" => "true"
1187         })
1188
1189       user = Repo.get!(User, user.id)
1190       assert user.info.locked == true
1191
1192       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1193     end
1194
1195     test "it unlocks an account", %{conn: conn} do
1196       user = insert(:user)
1197
1198       conn =
1199         conn
1200         |> assign(:user, user)
1201         |> post("/api/account/update_profile.json", %{
1202           "locked" => "false"
1203         })
1204
1205       user = Repo.get!(User, user.id)
1206       assert user.info.locked == false
1207
1208       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1209     end
1210   end
1211
1212   defp valid_user(_context) do
1213     user = insert(:user)
1214     [user: user]
1215   end
1216
1217   defp with_credentials(conn, username, password) do
1218     header_content = "Basic " <> Base.encode64("#{username}:#{password}")
1219     put_req_header(conn, "authorization", header_content)
1220   end
1221
1222   describe "GET /api/search.json" do
1223     test "it returns search results", %{conn: conn} do
1224       user = insert(:user)
1225       user_two = insert(:user, %{nickname: "shp@shitposter.club"})
1226
1227       {:ok, activity} = CommonAPI.post(user, %{"status" => "This is about 2hu"})
1228       {:ok, _} = CommonAPI.post(user_two, %{"status" => "This isn't"})
1229
1230       conn =
1231         conn
1232         |> get("/api/search.json", %{"q" => "2hu", "page" => "1", "rpp" => "1"})
1233
1234       assert [status] = json_response(conn, 200)
1235       assert status["id"] == activity.id
1236     end
1237   end
1238
1239   describe "GET /api/statusnet/tags/timeline/:tag.json" do
1240     test "it returns the tags timeline", %{conn: conn} do
1241       user = insert(:user)
1242       user_two = insert(:user, %{nickname: "shp@shitposter.club"})
1243
1244       {:ok, activity} = CommonAPI.post(user, %{"status" => "This is about #2hu"})
1245       {:ok, _} = CommonAPI.post(user_two, %{"status" => "This isn't"})
1246
1247       conn =
1248         conn
1249         |> get("/api/statusnet/tags/timeline/2hu.json")
1250
1251       assert [status] = json_response(conn, 200)
1252       assert status["id"] == activity.id
1253     end
1254   end
1255
1256   test "Convert newlines to <br> in bio", %{conn: conn} do
1257     user = insert(:user)
1258
1259     _conn =
1260       conn
1261       |> assign(:user, user)
1262       |> post("/api/account/update_profile.json", %{
1263         "description" => "Hello,\r\nWorld! I\n am a test."
1264       })
1265
1266     user = Repo.get!(User, user.id)
1267     assert user.bio == "Hello,<br>World! I<br> am a test."
1268   end
1269
1270   describe "POST /api/pleroma/change_password" do
1271     setup [:valid_user]
1272
1273     test "without credentials", %{conn: conn} do
1274       conn = post(conn, "/api/pleroma/change_password")
1275       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
1276     end
1277
1278     test "with credentials and invalid password", %{conn: conn, user: current_user} do
1279       conn =
1280         conn
1281         |> with_credentials(current_user.nickname, "test")
1282         |> post("/api/pleroma/change_password", %{
1283           "password" => "hi",
1284           "new_password" => "newpass",
1285           "new_password_confirmation" => "newpass"
1286         })
1287
1288       assert json_response(conn, 200) == %{"error" => "Invalid password."}
1289     end
1290
1291     test "with credentials, valid password and new password and confirmation not matching", %{
1292       conn: conn,
1293       user: current_user
1294     } do
1295       conn =
1296         conn
1297         |> with_credentials(current_user.nickname, "test")
1298         |> post("/api/pleroma/change_password", %{
1299           "password" => "test",
1300           "new_password" => "newpass",
1301           "new_password_confirmation" => "notnewpass"
1302         })
1303
1304       assert json_response(conn, 200) == %{
1305                "error" => "New password does not match confirmation."
1306              }
1307     end
1308
1309     test "with credentials, valid password and invalid new password", %{
1310       conn: conn,
1311       user: current_user
1312     } do
1313       conn =
1314         conn
1315         |> with_credentials(current_user.nickname, "test")
1316         |> post("/api/pleroma/change_password", %{
1317           "password" => "test",
1318           "new_password" => "",
1319           "new_password_confirmation" => ""
1320         })
1321
1322       assert json_response(conn, 200) == %{
1323                "error" => "New password can't be blank."
1324              }
1325     end
1326
1327     test "with credentials, valid password and matching new password and confirmation", %{
1328       conn: conn,
1329       user: current_user
1330     } do
1331       conn =
1332         conn
1333         |> with_credentials(current_user.nickname, "test")
1334         |> post("/api/pleroma/change_password", %{
1335           "password" => "test",
1336           "new_password" => "newpass",
1337           "new_password_confirmation" => "newpass"
1338         })
1339
1340       assert json_response(conn, 200) == %{"status" => "success"}
1341       fetched_user = Repo.get(User, current_user.id)
1342       assert Pbkdf2.checkpw("newpass", fetched_user.password_hash) == true
1343     end
1344   end
1345
1346   describe "POST /api/pleroma/delete_account" do
1347     setup [:valid_user]
1348
1349     test "without credentials", %{conn: conn} do
1350       conn = post(conn, "/api/pleroma/delete_account")
1351       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
1352     end
1353
1354     test "with credentials and invalid password", %{conn: conn, user: current_user} do
1355       conn =
1356         conn
1357         |> with_credentials(current_user.nickname, "test")
1358         |> post("/api/pleroma/delete_account", %{"password" => "hi"})
1359
1360       assert json_response(conn, 200) == %{"error" => "Invalid password."}
1361     end
1362
1363     test "with credentials and valid password", %{conn: conn, user: current_user} do
1364       conn =
1365         conn
1366         |> with_credentials(current_user.nickname, "test")
1367         |> post("/api/pleroma/delete_account", %{"password" => "test"})
1368
1369       assert json_response(conn, 200) == %{"status" => "success"}
1370       # Wait a second for the started task to end
1371       :timer.sleep(1000)
1372     end
1373   end
1374
1375   describe "GET /api/pleroma/friend_requests" do
1376     test "it lists friend requests" do
1377       user = insert(:user)
1378       other_user = insert(:user)
1379
1380       {:ok, _activity} = ActivityPub.follow(other_user, user)
1381
1382       user = Repo.get(User, user.id)
1383       other_user = Repo.get(User, other_user.id)
1384
1385       assert User.following?(other_user, user) == false
1386
1387       conn =
1388         build_conn()
1389         |> assign(:user, user)
1390         |> get("/api/pleroma/friend_requests")
1391
1392       assert [relationship] = json_response(conn, 200)
1393       assert other_user.id == relationship["id"]
1394     end
1395   end
1396
1397   describe "POST /api/pleroma/friendships/approve" do
1398     test "it approves a friend request" do
1399       user = insert(:user)
1400       other_user = insert(:user)
1401
1402       {:ok, _activity} = ActivityPub.follow(other_user, user)
1403
1404       user = Repo.get(User, user.id)
1405       other_user = Repo.get(User, other_user.id)
1406
1407       assert User.following?(other_user, user) == false
1408
1409       conn =
1410         build_conn()
1411         |> assign(:user, user)
1412         |> post("/api/pleroma/friendships/approve", %{"user_id" => to_string(other_user.id)})
1413
1414       assert relationship = json_response(conn, 200)
1415       assert other_user.id == relationship["id"]
1416       assert relationship["follows_you"] == true
1417     end
1418   end
1419
1420   describe "POST /api/pleroma/friendships/deny" do
1421     test "it denies a friend request" do
1422       user = insert(:user)
1423       other_user = insert(:user)
1424
1425       {:ok, _activity} = ActivityPub.follow(other_user, user)
1426
1427       user = Repo.get(User, user.id)
1428       other_user = Repo.get(User, other_user.id)
1429
1430       assert User.following?(other_user, user) == false
1431
1432       conn =
1433         build_conn()
1434         |> assign(:user, user)
1435         |> post("/api/pleroma/friendships/deny", %{"user_id" => to_string(other_user.id)})
1436
1437       assert relationship = json_response(conn, 200)
1438       assert other_user.id == relationship["id"]
1439       assert relationship["follows_you"] == false
1440     end
1441   end
1442
1443   describe "GET /api/pleroma/search_user" do
1444     test "it returns users, ordered by similarity", %{conn: conn} do
1445       user = insert(:user, %{name: "eal"})
1446       user_two = insert(:user, %{name: "ean"})
1447       user_three = insert(:user, %{name: "ebn"})
1448
1449       resp =
1450         conn
1451         |> get(twitter_api_search__path(conn, :search_user), query: "eal")
1452         |> json_response(200)
1453
1454       assert length(resp) == 3
1455       assert [user.id, user_two.id, user_three.id] == Enum.map(resp, fn %{"id" => id} -> id end)
1456     end
1457   end
1458
1459   describe "POST /api/media/upload" do
1460     setup context do
1461       Pleroma.DataCase.ensure_local_uploader(context)
1462     end
1463
1464     test "it performs the upload and sets `data[actor]` with AP id of uploader user", %{
1465       conn: conn
1466     } do
1467       user = insert(:user)
1468
1469       upload_filename = "test/fixtures/image_tmp.jpg"
1470       File.cp!("test/fixtures/image.jpg", upload_filename)
1471
1472       file = %Plug.Upload{
1473         content_type: "image/jpg",
1474         path: Path.absname(upload_filename),
1475         filename: "image.jpg"
1476       }
1477
1478       response =
1479         conn
1480         |> assign(:user, user)
1481         |> put_req_header("content-type", "application/octet-stream")
1482         |> post("/api/media/upload", %{
1483           "media" => file
1484         })
1485         |> json_response(:ok)
1486
1487       assert response["media_id"]
1488       object = Repo.get(Object, response["media_id"])
1489       assert object
1490       assert object.data["actor"] == User.ap_id(user)
1491     end
1492   end
1493
1494   describe "POST /api/media/metadata/create" do
1495     setup do
1496       object = insert(:note)
1497       user = User.get_by_ap_id(object.data["actor"])
1498       %{object: object, user: user}
1499     end
1500
1501     test "it returns :forbidden status on attempt to modify someone else's upload", %{
1502       conn: conn,
1503       object: object
1504     } do
1505       initial_description = object.data["name"]
1506       another_user = insert(:user)
1507
1508       conn
1509       |> assign(:user, another_user)
1510       |> post("/api/media/metadata/create", %{"media_id" => object.id})
1511       |> json_response(:forbidden)
1512
1513       object = Repo.get(Object, object.id)
1514       assert object.data["name"] == initial_description
1515     end
1516
1517     test "it updates `data[name]` of referenced Object with provided value", %{
1518       conn: conn,
1519       object: object,
1520       user: user
1521     } do
1522       description = "Informative description of the image. Initial value: #{object.data["name"]}}"
1523
1524       conn
1525       |> assign(:user, user)
1526       |> post("/api/media/metadata/create", %{
1527         "media_id" => object.id,
1528         "alt_text" => %{"text" => description}
1529       })
1530       |> json_response(:no_content)
1531
1532       object = Repo.get(Object, object.id)
1533       assert object.data["name"] == description
1534     end
1535   end
1536 end